auditing-serverless-event-source-trust

Auditing serverless event-source trust: when the handler trusts the event because it came from inside

Event-driven functions invert the usual request model: instead of a caller reaching an endpoint, a platform delivers an event to a handler. The recurring mistake is treating that delivery as authentication, the handler assumes the event is genuine, well-formed, and authorized simply because it came through the platform's plumbing. But the event source may accept writes from more parties than intended, the payload is attacker-influenceable input, and the same handler may be reachable by triggers it should never honor. The event payload is the source, the handler's action is the sink, and the bug is trust that was assumed rather than verified. You find it by mapping each function to what can trigger it and asking what the handler checks before it acts.

When to use

• Functions are triggered by events from queues, object-store notifications, schedules, topics, or gateways.
• A handler trusts the event payload's contents or its claimed source without verifying either.
• Per-event-type authorization or source authentication is assumed rather than checked in the handler.

Scope check

Audit functions, event sources, and execution identities you own or are authorized to assess, and inject crafted events only into non-production triggers where a spurious run is safe. A forged event can drive a real privileged action. If you can't name the authorization, stop.

The loop

1. Map each function to its triggers and its assumptions. For every handler, identify what can invoke it, a message queue, an object-store notification, a schedule, a topic, an upstream gateway, and what the handler takes for granted: that the event came from a trusted producer, that its fields are well-formed, that the actor behind it is already authorized. Those assumptions are the surface.

2. Check whether the event's true source is verified. A handler often treats any event the platform delivers as authentic. But an event source can be writable by more parties than intended: an object store others can write to, a queue with broad send permission, a public-facing gateway. Determine whether the handler confirms the event's origin and integrity, or merely that it arrived.